Update book/04-git-server/sections/protocols.asc

Co-authored-by: Ben Straub <[email protected]>

Author: Volker-Weissmann

book/04-git-server/sections/protocols.asc

@@ -196,9 +196,12 @@ It uses the same data-transfer mechanism as the SSH protocol but without the enc
 
 ===== The Cons
 
-Due to the lack of TLS or other cryptography, cloning over git:// might lead to an arbitrary code execution vulnerability and should therefore be avoided unless you know what you are doing:
-If you run `git clone git://example.com/project.git` an attacker who controls e.g your router can modify the repo you just cloned, inserting malicious code into it. If you then compile/run the code you just cloned, you will execute the malicious code.
-Running `git clone http://example.com/project.git` should be avoided for the same reason. Running `git clone https://example.com/project.git` does not suffer from the same problem (unless the attacker can provide a TLS certificate for example.com). Running `git clone [email protected]:project.git` only suffers from this problem if you accept a wrong ssh key fingerprint.
+Due to the lack of TLS or other cryptography, cloning over `git://` might lead to an arbitrary code execution vulnerability, and should therefore be avoided unless you know what you are doing.
+
+* If you run `git clone git://example.com/project.git`, an attacker who controls e.g your router can modify the repo you just cloned, inserting malicious code into it. If you then compile/run the code you just cloned, you will execute the malicious code.
+  Running `git clone http://example.com/project.git` should be avoided for the same reason.
+*  Running `git clone https://example.com/project.git` does not suffer from the same problem (unless the attacker can provide a TLS certificate for example.com). 
+  Running `git clone [email protected]:project.git` only suffers from this problem if you accept a wrong ssh key fingerprint.
 
 It also has no authentication, i.e. anyone can clone the repo (although this is often exactly what you want).
 It's also probably the most difficult protocol to set up.